IN THE CLAIMS: 



PleaSe cancel claims 1-31, 'and add claims 32-47, as follows: 




2. A method for database management and recovery, comprising: 
collecting network communications usage information in real-time from a plj*&lity of 
network devices utilizing a plurality of information source modules; 

filtering and aggregating the network communications usage information utilizing a plurality 
of gatherers; 

completing a plurality of data records from the filtered and aggregated network 
communications usage information utilizing a central event manager, the plurality of data 
records corresponding to network usage by a plurality ofjisers; 
storing the data records in a database; 
continuously monitoring a state of the gatherers; 
detecting a fault; and 

utilizing the state of the gatherers and the styfed data records to recover from the fault upon 
the detection thereof. 
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33. A method as recited in claijn 32, wherein the data records are stored in the database at 
a user-specified interval. 



34. A method as recited in claim 32, and further comprising time stamping the stored data 



records. 



35. A methodyds recited in claim 34, and further comprising deleting the stored data 
records upon the cessation of a predetermined amount of time after the storage utilizing the 
timestamp. 

36. A method as recited in claim 32, and further comprising caching the network 
communications usage information collected from the network device utilizing the gatherers. 
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37. A computer program product for database management and recover, comprising: 

(a) computer code for collecting network communications usage informatioi/in real-time from a 
plurality of network devices utilizing a plurality of information source/modules; 

(b) computer code for filtering and aggregating the network communications usage information 
utilizing a plurality of gatherers; 

(c) computer code for completing a plurality of data records fromihe filtered and aggregated 
network communications usage information utilizing a central event manager, the plurality of 
data records corresponding to network usage by a plurality of users; 

(d) computer code for storing the data records in a database; 

(e) computer code for continuously monitoring a state o£4he gatherers; 

(f) computer code for detecting a fault; and 

(g) computer code for utilizing the state of the gathers and the stored data records to recover 
from the fault upon the detection thereof. 

38. A computer program product as recited in claim 37, wherein the data records are 
stored in the database at a user-specified interval. 
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39. A computer program product as recited in claim 37, and further comprising computer 
code for time stamping the stored data records. 

40. A computer prograiyproduct as recited in claim 39, and further comprising computer 
code for deleting the stored data records upon the cessation of a predetermined amount of time after 
the storage utilizing the timestamp. 



41 . A computer program product as recited in claim 37, and further comprising computer 
code for caching the network communications usage information collected from the network devices 
utilizing the gatherers. 

42. A system for database management and recovery, comprising: 
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(a) information source modules for collecting network communications usage information in 
real-time from a plurality of network devices; / 

(b) gatherers coupled to the information source modules, the gatherer's adapted for filtering and 
aggregating the network communications usage information; / 

(c) a central event manager coupled to the gatherers, the central event manager adapted for 
completing a plurality of data records from the filtered apH aggregated network 
communications usage information, the plurality of data records corresponding to network 
usage by a plurality of users; / 

(d) a database coupled to the central event managerythe database adapted for storing the data 
records; / 

(e) logic for continuously monitoring a state opihe gatherers; 

(f) logic for detecting a fault; and / 

(g) logic for utilizing the state of the gatherers and the stored data records to recover from the 
fault upon the detection thereof. / 

43. A system as recited iryclaim 42, wherein the data records are stored in the database at 
a user-specified interval. / 

44. A system as recnted in claim 42, and further comprising computer code for time 
stamping the stored data records. 

45. A systena as recited in claim 44, and further comprising computer code for deleting 
the stored data records upon the cessation of a predetermined amount of time after the storage 
utilizing the timestaunp. 

46. A system as recited in claim 42, and further comprising computer code for caching 
the network communications usage information collected from the network devices utilizing the 
gatherers. / 

47. A method forrepOrtmg^jn the collection of network usage information from a 
plurality of network devices, the method compnstrrg>^^^ 
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(a) collecting network communications usage information in real-time fron/network devices at a 
plurality of layers utilizing multiple gatherers each including a plurality of information source 
modules each interfacing with one of the network devices and capable of communicating 
using a protocol specific to the network device coupled thereto; the network devices selected 
from the group consisting of routers, switches, firewalls, a^mentication servers, web hosts, 
proxy servers, netflow servers, databases, mail serverSyRADIUS servers, and domain name 
servers, the gatherers being positioned on a segmenj/of the network on which the network 
devices coupled thereto are positioned for minirpizing an impact of the gatherers on the 
network; 

(b) translating the network communications usdge information collected from the network 
devices utilizing the information sourceiriodules; 

caching the network communications/usage information collected from the network devices 
utilizing the gatherers; 

(d) normalizing the network communications usage information with the gatherers by excluding 
in / 

fields not required by a centra/ event manager coupled to the gatherers; 

W (e) defining an enhancement procedure utilizing the central event manager; 

o 7 

f (f) coordinating the collection of the network communications usage information by the 
f*\ / 

gatherers utilizing the/central event manager; 

■W / 

fU (g) filtering the networjc communications usage information utilizing the central event manager; 

(h) completing a plurality of data records from the filtered network communications usage 
information, th^f plurality of data records corresponding to network usage by a plurality of 
users; 

(i) aggregating the network communications usage information and the data records utilizing the 
central e/ent manager for reducing a number of the data records; 

(j) enhancing the aggregation with the gatherers in accordance with the defined enhancement 
procedure; 

tiirie stamping the data records; 

loring the time stamped data records in tables in a central database coupled to the central 
f event manager at a user-specified interval; and 

deleting the stored data records upon the cessation of a predetermined amount of time after 
the storage utilizing the timestamp. 
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